26/01/2026
🚨 If you're deploying Copilot, you're deploying AI agents. The security model just changed.
Microsoft's latest research shows that AI agents create a new attack surface: they access data, make decisions, and take actions based on natural language input. If an attacker can influence how an agent sequences those actions, traditional controls won't catch it.
**Here's what organisations need to do:**
**1. Understand the new risk model** ⚠️
AI agents operate with permissions, but their behaviour is determined by natural language prompts – including malicious ones. Runtime monitoring is now critical.
**2. Enable runtime protection** 🛡️
Microsoft Defender now performs security checks on every tool invocation before ex*****on, inspecting both intent and destination as it happens. This needs to be configured before agents go live.
**3. Get data governance right first** 📊
Data classification and governance aren't optional anymore. Agents can only be as secure as the data environment they operate in. Sort this before deployment, not after.
**4. Monitor agent behaviour in real time** 🎯
Move from "who has access" to "what can this agent do and how do we monitor it." Activity logs and XDR alerts give visibility into blocked invocations and potential attacks.
**Expected outcome:**
You'll have visibility into agent behaviour, runtime controls to block malicious actions, and a governance foundation that scales with AI adoption.
This is the early stages of a new security discipline. Get across it now rather than playing catch-up later.
Read more:
🔗 https://ap1.hubs.ly/y0xzyl0
🔗 https://ap1.hubs.ly/y0xzD_0
🔗 https://ap1.hubs.ly/y0xzMm0
If you're exploring AI agents or rolling out Copilot, reach out. We're helping organisations get their governance foundations right before they deploy.
Why securing AI agents at runtime is essential as attackers find new ways to exploit generative orchestration.
